X (Re)

X (Re)
Court (s) Database
Federal Court Decisions
Date
2017-09-27
Neutral citation
2017 FC 1048
Notes
Reported Decision
Decision Content
TOP SECRET
Date: 20170927
Dockets: CONF-3-17
Citation Number: 2017 FC 1048
Ottawa, Ontario, September 27, 2017
PRESENT: THE CHIEF JUSTICE
Docket: ||||||||||||||||
BETWEEN:
IN THE MATTER OF AN APPLICATION BY |||||||||||||||||||||||||||| FOR WARRANTS PURSUANT TO SECTIONS 12 AND 21 OF THE CANADIAN SECURITY INTELLIGENCE SERVICE ACT, RSC 1985, c C-23
and
IN THE MATTER OF |||||||||||||||||||||||||||| |||||||||||||||||||||||||||||||||||||||||| THREAT-RELATED ACTIVITIES
and
Docket: ||||||||||||||||
IN THE MATTER OF AN APPLICATION BY |||||||||||||||||||||||||||||||||||| FOR WARRANTS PURSUANT TO SECTIONS 12 AND 21 OF THE CANADIAN SECURITY INTELLIGENCE SERVICE ACT, RSC 1985, c C-23
and
IN THE MATTER OF ISLAMIST TERRORISM
PUBLIC JUDGMENT AND REASONS
I. Introduction 2
II. Background 9
III. The BII Authorizations Requested by CSIS 13
IV. Issues 17
V. Analysis 19
A. Applicable legal principles 19
B. Can the Court authorize CSIS to obtain BII in respect of communications accounts corresponding to telephone numbers or electronic identifiers that may in the future come to its attention in the course of its investigations, where CSIS has not described and established their specific nexus to those investigations? 21
(1) General 21
(2) The BII Warrant and the first type of proposed amendments to the warrants issued in |||||||||||||| 27
C. Can the Court authorize CSIS to obtain BII in respect of communications accounts identified pursuant to its review of specifically defined information obtained in relation to |||||| || named individuals and |||||| additional individuals who have been identified by reference to |||||||||||||||||||||||||||||||| 30
D. Can the Court authorize an employee of CSIS to obtain BII of a communications account that corresponds to a telephone number or an electronic identifier, where a “Chief” within CSIS determines that the account was identified during its investigation, and that the BII would assist CSIS in its investigation? 33
VI. Conclusion 39
APPENDIX I 1
I. Introduction
[1] These applications concern requests by the Canadian Security Intelligence Service [CSIS] for warrants in relation to its investigation of two separate groups of activities that I am satisfied may on reasonable grounds be suspected of constituting threats to the security of Canada. CSIS has defined the first group in terms of “Islamist terrorism.” Those activities are the focus of the application in Court file |||||||||||||||||||||||| The second group consists of certain activities engaged in by |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| Those activities are described in materials filed by CSIS in Court file ||||||||||||||||||||||
[2] The applications raise three issues pertaining to CSIS’s request to be able to obtain basic identifying information [BII] from communications services providers [CSPs]. That information would be obtained in respect of communications accounts of individuals whose telephone number, |||||||||||||||||||||||||||||||||||||||||||||||||||||||| or other electronic identifiers may in the future come to CSIS’s attention in the course of its investigations of the activities described above. BII consists of the name and address of a subscriber to a communications account, |||||||||||||||||||||||||||||||||||||||||||||||||||||||| |||||||||||||||||||||||||||||[The information relating to IP addresses in certain circumstances] ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
[3] The Attorney General concedes that in the absence of judicial pre-authorization, CSIS cannot obtain BII in respect of a person’s communications account without contravening that person’s right to be secure against unreasonable search or seizure, pursuant to section 8 of the Canadian Charter of Rights and Freedoms, Part I of the Constitution Act, 1982, being Schedule B to the Canada Act 1982 (UK), 1982, c 11 [the Charter].
[4] Accordingly, the focus of these applications has been upon a broad BII authorization that CSIS is seeking in each of |||||||||||||||||||||| and ||||||||||||||||||||||, a narrower BII authorization that it is seeking in |||||||||||||||||||||| alone, and a delegation issue that exists with respect to the first of those two authorizations. More specifically, the three issues raised by these applications are as follows:
Can the Court authorize CSIS to obtain BII in respect of communications accounts corresponding to telephone numbers or electronic identifiers that may in the future come to its attention in the course of its investigations, where CSIS has not described and established their specific nexus to those investigations? (This is a common issue in both applications.)
Can the Court authorize CSIS to obtain BII in respect of communications accounts identified pursuant to its review of specifically defined information obtained in relation to |||||||| named individuals and |||||| additional individuals who have been identified by |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| (This issue arises only in ||||||||||||||||||||||||||
Can the Court authorize an employee of CSIS to obtain BII in respect of a communications account that corresponds to a telephone number or an electronic identifier, where a “Chief” within CSIS determines that the account was identified during its investigation, and that the BII would assist CSIS in its investigation? (This is a common issue in both applications.)
[5] In my view, the Court cannot provide the first of the requested authorizations described above. It does not meet the basic requirements for authorizing intrusive activity by the state.
[6] Before the Court may authorize CSIS to obtain BII or to exercise other intrusive search powers, the Court must have an understanding of the nexus between CSIS’s investigation and the specific persons or class of persons whose privacy rights would be engaged. Only then can the Court assess whether the specific privacy interests of those persons must give way to the interests of the state in obtaining the information in question. In addition, CSIS must satisfy the requirements for obtaining a warrant set forth in subsections 21(2) and (3) of the Canadian Security Intelligence Service Act, RSC 1985, c C-23 [the Act], in respect of such person or class of persons.
[7] The Court has not been provided with that required understanding of the nexus described above in respect of the broad BII authorization that CSIS is seeking in both |||||||||||||||||||||| and |||||||||||||||||||||| Indeed, the Court has not been provided with any sense whatsoever as to how the individual or class of individuals whose privacy interests would be intruded upon would be linked to its investigations.
[8] With respect to the second, narrower, BII authorization that CSIS has requested in |||||||||||||||||||||| alone, I am satisfied that the required nexus has been described and established by CSIS. This is because that authorization is confined to telephone numbers or electronic identifiers that CSIS may identify in the course of reviewing information that specifically relates to |||||||||||| identified individuals who are subjects of investigation. |||||||| of those individuals have been identified by name, while the remaining |||||| have been identified by reference to |||||| ||||||||||||||||||||||||||||||||||||||||||||||||
[9] The information that relates to those individuals includes BII |||||||||||||||||||||||||||||||||||||||| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| information will reveal the |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| identifiers |||||||||||||||||||||||||||||||||||||||||| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
[10] I am satisfied that there are reasonable grounds to believe that anyone with whom those |||||||||||| individuals has been in contact may be able to provide information that will assist CSIS to advance its investigation into the threat-related activities |||||||||||||||||||||| that it has identified. For this reason, I am satisfied that there are reasonable grounds to believe that CSIS requires the BII relating to the communications accounts that correspond to the telephone numbers and electronic identifiers of those third parties, to advance its investigation. Without being able to obtain that BII, |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
[11] Although the Court has not been provided with the names of |||||| of those individuals, the Court has been provided with sufficient information regarding |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| to be able to conduct the assessment required by section 8 of the Charter. That assessment is whether the specific privacy interests of those individuals must give way to the interests of the state in obtaining the BII that CSIS requires to advance its investigation into the identified threat-related activities ||||||||||||||||||||||||
[12] At the time it issues a warrant authorizing the exercise of powers that would intrude upon the privacy interests of one or more individuals or classes of persons, the Court does not need to know the specific names of those individuals or persons within the class. However, the Court needs to have a sufficient understanding of the nexus between CSIS’s investigation and the specific persons or class of persons whose privacy interests would be intruded upon. The Court has been provided with that understanding in respect of the |||||| individuals |||||||||||||||||||||||||||||||||| have been described to the Court, as well as in respect of the third parties who CSIS may discover have been in contact with those individuals, or with the |||||| other individuals who have been identified by name.
[13] Where the Court is not able to conduct, in advance, the assessment required by section 8 of the Charter in respect of the specific individuals or class of individuals whose privacy interests would be engaged by CSIS’s access to their BII, CSIS will need to return to the Court each time it identifies additional telephone numbers or electronic identifiers in respect of which it wishes to obtain BII from a CSP. At that time, CSIS will have to establish a sufficient nexus between the telephone number or other identifier in question and its investigations to satisfy the Court that there are reasonable grounds to believe that CSIS requires the BII of the corresponding communications account to advance those investigations.
[14] The third issue raised in these proceedings is whether the Court can authorize any employee of CSIS to obtain BII in respect of a communications account, where an individual holding the position of Chief within CSIS makes certain determinations. In my view, the Court cannot do so, because this would amount to the delegation of functions that must be exercised by the Court itself. Although the Court may delegate to CSIS certain types of decisions with respect to the execution of its warrants, it cannot delegate the determination of which specific communications accounts will be the subject of requests to CSPs for BII. To the extent that this determination requires an assessment of whether the privacy interests of the persons in question must give way to the interests of CSIS in obtaining the BII in question, this is a function that must be performed by the Court.
[15] I recognize that the conclusions I have reached in respect of the first and third issues discussed above may well impose a potentially significant additional burden on CSIS. I also recognize that this may give rise to additional costs and delays associated with obtaining BII authorizations in relation to telephone numbers or electronic identifiers that may come to CSIS’s attention during the course of its investigations into Islamist terrorism and the threat-related activities |||||||||||||||||||||||| Given the adverse implications that the potential delays, in particular, may have for CSIS’s ability to investigate threat-related activities, the Court will remain open to considering alternate approaches that are Charter compliant.
[16] These reasons for judgment are being issued contemporaneously with my reasons for judgment in |||||||||||||||||||||| which concerns CSIS’s use of cellular-site simulator [CSS] technology to capture the identifying characteristics of an individual’s mobile device(s) without a warrant |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
II. Background
[17] This Court has been authorizing CSIS to obtain subscriber and similar information from CSPs in respect of accounts corresponding to telephone numbers and electronic identifiers for many years. In most cases, such authorizations have been provided in respect of the |||||||||||||||||||| |||||||||||||||||||||||||||||||||||||||||||||||| identifiers of known individuals who are subjects of investigation, or of third parties with whom such individuals may communicate. However, in some cases the Court has also authorized CSIS to obtain such information in respect of communications accounts of known, but still unidentified, individuals. For example, such authorizations have been provided in respect of individuals |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| The same is true with respect to the |||||||||||||||||||| |||||||||||||||||||||||||||||||||||||||||||||||| identifiers of third parties with whom such known, but as yet unidentified, individuals have communicated, or may in the future communicate. Given that the |||||||||||||||||||| |||||||||||||||||||||||| identifiers in question are not yet known at the time of the warrant application, they cannot be specified in the warrant.
[18] The types of authorizations described above have always been provided in warrants that have focused primarily upon named subjects of investigation, also known as “targets,” and their involvement in particular threat-related activities. In some of those warrants, the Court also granted authorizations to obtain BII in relation to the communication accounts associated with |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| identifiers that CSIS identified during its investigation of the threat to the security of Canada in question, even where there was no direct link between such |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| identifiers and the target(s) identified in the warrants. There was simply the indirect link that existed by virtue of the fact that the |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| identifier would be identified in the future course of CSIS’s investigation of the same threat to the security of Canada with which the named targets were also connected.
[19] However, beginning in 2013, some of my colleagues and I started to express concerns about granting the latter type of authorizations. After CSIS failed to avail itself of opportunities to address our concerns, we began to narrow the scope of the powers that we authorized. However, given that we did so in the context of individual applications for warrants, which sometimes had to be dealt with on an urgent basis, this gave rise to some inconsistencies in the language of the authorizations in question.
[20] As a result of the foregoing, Justice Noël advised CSIS in X (Re), 2016 FC 1105, at para 230 [X (Re)], that broad authorizations of the type being sought in the present proceedings, as well as authorizations to obtain |||||||||||||||||||||||||||||||||||||||||||||||||||||| would no longer be granted by the Court until they were the subject of further exchanges between the Court and CSIS. Soon afterwards, in |||||||||||||||||||||||||| I requested that CSIS endeavour to establish the legal basis for this Court to authorize such powers, in a separate proceeding. I explained that if CSIS could establish that legal basis, the powers in question could be authorized in a single application that would be made each year. Among other things, I considered that such an approach would avoid having to deal with CSIS’s requests for such broad authorizations in the context of multiple different applications made over the course of a year, that are otherwise focused on named subjects of investigation. I made the foregoing request after declining to issue such an authorization.
[21] The application in |||||||||||||||||||||| is CSIS’s response to my request and to Justice Noël’s decision. CSIS requested that I hear that application.
[22] Given the position taken by Justice Noël in X (Re) with respect to broad authorizations to obtain access to subscriber data, CSIS’s application in |||||||||||||||||||||| was separated into two phases. The first phase focused on warrant powers that CSIS sought in respect of individuals who are subjects of its investigation into the threat to the security of Canada posed by |||||||||||||||||| That phase of the proceeding took place in February of this year, and was based on affidavit evidence provided by Mr. |||||||||||||||||||||||||||| After being satisfied that |||||||||||||||| is engaged in activities that may on reasonable grounds be suspected of constituting threats to the security of Canada, Justice Noël issued the warrants that were sought at that time.
[23] At Justice Noël’s suggestion, the second phase of |||||||||||||||||||| took place before me, and concerned two additional authorizations that CSIS is seeking to add to three of the warrants that Justice Noël issued in the initial phase of that proceeding. The first of those authorizations is essentially the same as the sole, and very broad, authorization being sought in |||||||||||||||||||||| [the BII Warrant]. The second is much more focused, and would enable CSIS to obtain the BII corresponding to the communications accounts of third parties whose telephone number or electronic identifier has been linked to one or more of |||||||| named individuals, or to |||||| unnamed individuals |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| At CSIS’s suggestion, the evidentiary hearings and oral submissions in this second phase of |||||||||||||||||||||| as well as in |||||||||||||||||||||| were held separately, but concurrently, on |||||||||||||||||||||||||||||||||||||||| and |||||||||||||||||| of this year.
[24] To preserve the status quo with respect to the BII-type power that is being sought in |||||||||||||||||||||| in relation to the threat to the security of Canada posed by Islamist terrorism, I granted an interim order on |||||||||||||||||||||||||||||||||| which provided CSIS with that authorization for 60 days, to permit me to complete this decision. [1]
[25] In view of the nature of the legal issues raised in this application, the Court retained Mr. Gordon Cameron and Mr. Owen Rees to act as amici curiae.
[26] Given that BII authorizations similar to those being requested in these applications may be sought in future proceedings before other designated judges of this Court, I considered it appropriate to convene the designated judges of the Court to join me on the bench, so that they would have the benefit of the evidence provided by the affiants, including on cross-examination by the Amici. I also considered it to be important that they have the benefit of responses provided by the affiants to questions that any of them, or I, might pose. This should assist each of the designated judges of the Court in any future applications that may involve a request for a BII or similar authorization, and could reduce the need for similar evidence in those applications.
[27] Notwithstanding the involvement of other designated judges of this Court in this proceeding, I assured CSIS and representatives of the Attorney General at the outset of the initial hearing on these applications that my judicial independence would not thereby be compromised in any way. I, and I alone, have decided the issues that have been raised in these applications.
[28] Like several of my designated colleagues before me in previous applications dating back several years, I am satisfied that there are reasonable grounds to believe that activities that CSIS has defined as “Islamist terrorism” constitute a threat to the security of Canada, and that the same is true with respect to the threat-related activities engaged in by |||||||||||||||| that CSIS has identified.
[29] Accordingly, the balance of these reasons for judgment will focus on the three issues that are identified at paragraph 4 above.
[30] In passing, and for completeness, I will add that CSIS informed the Court earlier this year that it did not intend to seek or address in either |||||||||||||||||||||| or |||||||||||||||||||||| the ||||||||||||||||||||||||| |||||||||||||||||||||||||||| that was referred to in X (Re), above. The Court understands that CSIS may return to the Court to make separate submissions in respect of that power at a future date, and that CSIS will not in the meantime be seeking any authorizations to use that power in respect of |||||||||||||||||||||||||| communications accounts that correspond to telephone numbers or electronic identifiers that have no direct nexus with identified subjects of investigation.
III. The BII Authorizations Requested by CSIS
[31] The warrant that CSIS has requested the Court to issue in |||||||||||||||||||||| consists of a single authorization. It is as follows:
I authorize the Director and any employee of the service acting under his authority to obtain BII relating to any account with a CSP where a Chief determines that
a) the account was identified during the investigation of Islamist terrorism and
b) the identity of the subscriber to the account will assist in the investigation of Islamist terrorism.
[32] “BII” is defined in the warrant to mean:
The name of a subscriber to an account;
The subscriber’s address;
|||||||||||||||||||||||[The information relating to IP addresses in certain circumstances] |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
[33] In essence, this authorization would enable CSIS to obtain BII in respect of any communications account corresponding to any telephone number or electronic identifier that CSIS may identify during its investigation into Islamist terrorism, where a Chief within CSIS determines that BII will assist CSIS to advance its investigation.
[34] The Attorney General analogizes this authorization to a power to obtain “telephone book” information, which traditionally has been required to identify individuals. The Attorney General, the affiant in |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| and the affiant in |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| each maintained that this was the sole purpose of the BII authorization being requested. In this regard, they emphasized that the BII authorization is not used to track online activity. The Attorney General added that if CSIS wanted to exercise such a power or indeed any other intrusive powers in respect of a person, it would have to return to the Court to seek specific authorizations to do so.
[35] The BII Warrant that has been requested in |||||||||||||||||||||| also provides that if, in executing the warrant, CSIS provides |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| CSIS shall also provide |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| Islamist terrorism. This requirement has been included as a safeguard to help ensure that BII is provided in respect of the correct account, |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ||||||||||||||||||||||||||||||||||||||||||||||
[36] For the purposes of the BII Warrant, “Islamist terrorism” is defined to mean “activities in paragraph (c) of the definition of ‘threats to the security of Canada’ found in section 2 of the Act |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ||||||||| including activities of the |||||||||||||| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
[37] Both Mr. |||||||||||| and Mr. |||||||||| testified that an authorization to obtain BII is crucial to CSIS’s ability to investigate the threats to the security of Canada posed by the activities |||||||||||| |||||||| and Islamist terrorism. This is because this may be the only manner in which CSIS can identify a person who is behind a phone number||||||||||||[or an electronic identifier] |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| In addition, the ability to identify individuals and assess the nature of their relationship to Islamist terrorism or to the threat related activities |||||||||||||||||||||| is a fundamental building block of an investigation. This is particularly so given that many people associated with the threats in question interact exclusively or primarily by electronic means, and may never meet in person. According to Mr. |||||||||||| “identification is |||||||||||||||||||||||||||||||||||||||||||| part of the job,” and |||||||||||||||| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| He emphasized that, without being able to identify someone, CSIS would not be able to fulfill its mandate.
[38] According to Mr. |||||||||||||||| the 2014-2016 Intelligence Priorities for CSIS from the Minister of Public Safety |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
[39] The BII authorizations that CSIS is seeking in the amendments that it has requested be made to three of the warrants were issued in the first phase of |||||||||||||||||||||| are of two types. The first type would provide essentially the same broad power that is being sought in |||||||||||||||||||||||| That is to say, it would provide essentially the same authorization as is being requested in the BII Warrant, albeit in respect of communications accounts that are identified during CSIS’s investigation of the threat-related activities |||||||||||||||||||||| that it has described.
[40] The second type of authorization that CSIS is seeking to add to three of the warrants that have been issued in |||||||||||||||||||||| is much narrower. In brief, it would authorize CSIS to obtain BII in respect of communications accounts identified pursuant to its review of specifically defined information obtained in relation to |||||| named individuals and |||||| additional individuals who ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
[41] It bears underscoring that no individuals are named in the BII Warrant being sought in |||||||||||||||||||||||| or in the first group of amendments that CSIS is seeking to add to three of the warrants that have been issued in |||||||||||||||||||||| In the words of Mr. |||||||||||||| “the warrant itself is not |||||||||||||||||||||||||||||||||||||||||||||||||||| it’s against Islamist terrorism.” Likewise, the amendments sought to three of the warrants issued in |||||||||||||||||||||| are directed towards the threat-related activities |||||||||||| ||||||||.
IV. Issues
[42] As explained at paragraph 4 above, the applications in |||||||||||||||||||||| and |||||||||||||||||||| raise the following three issues:
Can the Court authorize CSIS to obtain BII in respect of communications accounts corresponding to telephone numbers or electronic identifiers that may in the future come to its attention in the course of its investigations, where CSIS has not described and established their specific nexus to those investigations?
Can the Court authorize CSIS to obtain BII in respect of communications accounts identified pursuant to its review of specifically defined information obtained in relation to |||||| named individuals and |||||| additional individuals who have been identified |||||||||||||||||||||||||||||||||||||||||||| ||||||||||||||||||||||
Can the Court authorize an employee of CSIS to obtain BII in respect of a communications account that corresponds to a telephone number or an electronic identifier, where a “Chief” within CSIS determines that the account was identified during its investigation, and that the BII would assist CSIS in its investigation?
[43] In both |||||||||||||||||||||| and |||||||||||||||||||||||| the Attorney General raised an additional issue, namely, the threshold issue of whether a warrant is required to obtain BII from a CSP. However, in each proceeding, the Attorney General conceded that a warrant is required to obtain BII from a CSP, because it may engage privacy rights that are protected by section 8 of the Charter. This is because “|||||||||||||||||||| information can be revealed to [CSIS] when BII is obtained from CSPs.” Indeed, this was demonstrated by a number of examples included in the Attorney General’s written submissions.
[44] The Amici agreed. They maintained that, in view of the fact that CSIS may well be able to use BII |||||||||||||||||||||||||||||||||||||||||||||| to link previously anonymous |||||||||||||||||||||||||||| activity to a named individual, such activity by CSIS would normally require a warrant. I agree.
[45] Given the Attorney General’s acknowledgement that a warrant is required to access BII from a CSP, it is unnecessary to address this issue in detail. I will simply note that the linking of previously anonymous |||||||||||||||| activity to an individual’s identity “engages a high level of informational privacy” (R v Spencer, 2014 SCC 43, at para 51 [Spencer]). As such, obtaining the information to make such a link, |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| would constitute a “search” that is more invasive than the minimally intrusive warrantless searches that are authorized by section 12 of the Act.
[46] The same is true with respect to telephone numbers, which can assist CSIS to obtain valuable personal information about a person. This was corroborated by one of the examples provided by Mr. |||||||||||| in his affidavit.
[47] I will simply add that the Attorney General’s position that a warrant is required to obtain BII is consistent with the position that she took in |||||||||||||||||||||| where she stated on multiple occasions that a warrant would be required to obtain subscriber information pertaining to any identifiers ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
V. Analysis
A. Applicable legal principles
[48] Section 8 of the Charter provides that “[e]veryone has the right to be secure against unreasonable search or seizure.”
[49] It follows that section 8 of the Charter does not afford protection against all searches, only against unreasonable ones (R v Gomboc, 2010 SCC 55, at para 20 [Gomboc]).
[50] In assessing whether a search is “unreasonable,” courts must adopt “a purposive approach that emphasizes the protection of privacy as a prerequisite to individual security, self-fulfilment and autonomy as well as to the maintenance of a thriving democratic society” (Spencer, above, at para 15).
[51] Broadly speaking, a determination of whether a search is unreasonable requires a balancing assessment of “whether in a particular situation the public’s interest in being left alone by government must give way to the government’s interest in intruding on the individual’s privacy in order to advance its goals” (Hunter et al v Southam Inc, [1984] 2 SCR 145, at 159–160 [Hunter]).
[52] Given that the underlying purpose of section 8 is to protect individuals from unjustified state intrusions upon their privacy, prior authorization of those intrusions is presumptively required. Such authorization must be given by an entirely neutral and impartial arbiter who is capable of acting judicially in balancing the interests of the state against those of the individual (Spencer, above, at para 68; Goodwin v BC (Superintendent of Motor Vehicles), 2015 SCC 46, at para 56 [Goodwin]; Hunter, above, at 160-162).
[53] In addition, the neutral arbiter must be satisfied that the person seeking the authorization has reasonable grounds, established under oath, to believe that the relevant statutory or other conditions to be met before the search power may be exercised, have in fact been met (Hunter, above, at 166-168).
[54] In deciding whether to issue a warrant, the neutral arbiter must have sufficient flexibility to consider all of the circumstances that may be relevant to the exercise of discretion to issue the warrant, and to impose any conditions that may be considered necessary (Baron v Canada, [1993] 1 SCR 416, at paras 437, 439, 440 [Baron]).
B. Can the Court authorize CSIS to obtain BII in respect of communications accounts corresponding to telephone numbers or electronic identifiers that may in the future come to its attention in the course of its investigations, where CSIS has not described and established their specific nexus to those investigations?
(1) General
[55] In her written and oral submissions, the Attorney General characterized this issue as being whether the Act authorizes a judge of this Court to issue warrants against “threat-related activities.”
[56] In support of her position that the Act is sufficiently flexible to allow for the issuance of warrants in respect of activities, the Attorney General notes that section 12 of the Act empowers CSIS to investigate activities, and that the definition of “threats to the security of Canada” that is set forth in section 2 of the Act also refers to activities, without any reference to the persons who would be conducting those activities. The Attorney General further notes that paragraph 21(2)(d) requires a warrant application to be accompanied by an affidavit that addresses various issues, including “the identity of the person, if known, whose communication is proposed to be intercepted or who has possession of the information, record, document or other thing proposed to be obtained” (emphasis added).
[57] The Attorney General submits that it may be inferred from all of the foregoing that warrants issued pursuant to section 21 of the Act can be obtained to investigate identified threat-related activities. She maintains that this is so even where the warrant does not name any individuals or describe the specific nexus between CSIS’s investigation and the individuals whose privacy interests would be intruded upon.
[58] I disagree. With respect, that position confuses the activities that CSIS is authorized to investigate under section 12 of the Act, with the privacy interests that might be engaged by a warrant issued under section 21 in connection with an investigation. Privacy interests are not held by activities or threats, such as those posed by |||||||||||||||| or “Islamist terrorism,” or in respect of an event that might be the focus of an investigation, such as the Vancouver Olympics or the G7 meeting that took place in Toronto.
[59] Privacy interests are held by individuals and corporations, whether they be subjects of investigation, persons whose connection to an investigation may remain to be ascertained, or persons who might, on reasonable grounds, be believed to have information that is likely to assist an investigation. In my view, the words “the identity of the person, if known” (emphasis added) in paragraph 21(2)(d) simply reflects the practical reality that CSIS may not know, at the time it applies for a warrant, the identity of an ascertainable person whose communication is proposed to be intercepted, or who has possession of the information, record, document or other thing proposed to be obtained under the warrant, as contemplated by that provision.
[60] Accordingly, the more relevant question that arises in these proceedings is whether CSIS can be prospectively authorized to obtain BII in relation to communications accounts that may in the future come to its attention in the course of its investigations, where CSIS has not yet described and established their specific nexus with those investigations. In my view, the answer is “no, except in exceptional circumstances that have not been demonstrated to exist in this case.”
[61] This is because persons who are responsible for authorizing the use of intrusive powers are required to consider the impact of such intrusion on the specific “subject of the search” (Hunter, above, at 157; Spencer, above, at para 36 (emphasis added)). In other words, an assessment must be made of the context of each “particular situation,” and its impact on “the individual.” As the Amici underscored, the balancing analysis to be conducted is between the interests of the state and the interests of the specific individual whose privacy interests are at issue (Hunter, above, at 159-160, 161-162, 167; Baron, above, at 435-436, 437; R v Rodgers, 2006 SCC 15, at para 27 (emphasis added)).
[62] Where a “class of persons” whose privacy interests may be encroached upon can be described in a manner that enables the Court to clearly understand the nexus between those persons and the threat-related activities that ar